To: 


Of: 


ICO. 


Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


Yes Consumer Solutions Limited 


Office 3, 6" Floor, Intergen House, 65-67 Western Road, 
Hove, England, BN3 2JQ 


The Information Commissioner (“the Commissioner”) has decided to 
issue Yes Consumer Solutions Limited (“YCSL”) with a monetary 
penalty under section 55A of the Data Protection Act 1998 (“DPA”). The 
penalty is being issued because of a serious contravention of regulation 
21 of the Privacy and Electronic Communications (EC Directive) 
Regulations 2003 (“PECR”). 


This notice explains the Commissioner’s decision. 


Legal framework 


YCSL, whose registered office is given above (Companies House 
Registration Number: 10596925) is the organisation stated in this 
notice to have used a public electronic communications service for the 
purpose of making unsolicited calls for the purposes of direct marketing 


contrary to regulation 21 of PECR. 


Regulation 21 applies to the making of unsolicited calls for direct 
marketing purposes. It means that if a company wants to make calls 


promoting a product or service to an individual who has a telephone 
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number which is registered with the Telephone Preference Service Ltd 


(“TPS”), then that individual must have given their consent to that 


company to receive such calls. 

Regulation 21 paragraph (1) of PECR provides that: 

"(1) A person shall neither use, nor instigate the use of, a public 

electronic communications service for the purposes of making 

unsolicited calls for direct marketing purposes where- 

(a) the called line is that of a subscriber who has previously 
notified the caller that such calls should not for the time being 


be made on that line; or 


(b) the number allocated to a subscriber in respect of the called 


line is one listed in the register kept under regulation 26.” 


Regulation 21 paragraphs (2), (3), (4) and (5) provide that: 


"(2) A subscriber shall not permit his line to be used in contravention 


of paragraph (1). 


(3) A person shall not be held to have contravened paragraph (1)(b) 
where the number allocated to the called line has been listed on the 
register for less than 28 days preceding that on which the call is 


made. 


(4) Where a subscriber who has caused a number allocated to a line of 
his to be listed in the register kept under regulation 26 has notified 
a caller that he does not, for the time being, object to such calls 


being made on that line by that caller, such calls may be made by 
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that caller on that line, notwithstanding that the number allocated 


to that line is listed in the said register. 


(5) Where a subscriber has given a caller notification pursuant to 


paragraph (4) in relation to a line of his— 


(a) the subscriber shall be free to withdraw that notification at 
any time, and 
(b) where such notification is withdrawn, the caller shall not 


make such calls on that line.” 


Under regulation 26 of PECR, the Commissioner is required to maintain 
a register of numbers allocated to subscribers who have notified them 
that they do not wish, for the time being, to receive unsolicited calls for 
direct marketing purposes on those lines. The TPS is a limited company 
which operates the register on the Commissioner’s behalf. Businesses 
who wish to carry out direct marketing by telephone can subscribe to 
the TPS for a fee and receive from them monthly a list of numbers on 


that register. 


Section 122(5) of the DPA18 defines direct marketing as “the 
communication (by whatever means) of any advertising material which 
is directed to particular individuals”. This definition also applies for the 
purposes of PECR (see regulation 2(2) PECR & Schedule 19 paragraphs 
430 & 432(6) DPA18). 


Prior to 29 March 2019, the European Directive 95/46/EC defined 
‘consent’ as “any freely given specific and informed indication of his 
wishes by which the data subject signifies his agreement to personal 


data relating to him being processed”. 
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Consent in PECR is now defined, from 29 March 2019, by reference to 
the concept of consent in Regulation 2016/679 (“the GDPR”): 
regulation 8(2) of the Data Protection, Privacy and Electronic 
Communications (Amendments etc) (EU Exit) Regulations 2019. Article 
4(11) of the GDPR sets out the following definition: “‘consent’ of the 
data subject means any freely given, specific, informed and 
unambiguous indication of the data subject's wishes by which he or 
she, by a statement or by a clear affirmative action, signifies 


agreement to the processing of personal data relating to him or her”. 


An “Individual” is defined in regulation 2(1) of PECR as “a living 


individual and includes an unincorporated body of such individuals”. 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


Under section 55A (1) of the DPA (as amended by PECR 2011 and the 
Privacy and Electronic Communications (Amendment) Regulations 
2015) the Commissioner may serve a person with a monetary penalty 


notice if the Commissioner is satisfied that - 

“(a) there has been a serious contravention of the requirements of the 
Privacy and Electronic Communications (EC Directive) Regulations 
2003 by the person, and 


(b) subsection (2) or (3) applies. 


(2) This subsection applies if the contravention was deliberate. 
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(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that 


the contravention would occur, but 


(b) failed to take reasonable steps to prevent the 


contravention.” 


The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR were enacted to protect the individual’s fundamental right to 
privacy in the electronic communications sector. PECR were 
subsequently amended and strengthened. The Commissioner will 
interpret PECR in a way which is consistent with the Regulations’ 
overall aim of ensuring high levels of protection for individuals’ privacy 


rights. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of Part 9, Schedule 20 of that Act). 


Background to the case 


YCSL’s Companies House listing describes its nature of business as 
‘Other telecommunications activities’. It is understood that YCSL 


purport to offer equity release services and call blocking services on a 


5 


18. 


19. 


ð 

ICO. 

Information Commissioner's Office 
subscription basis. It first came to the attention of the Commissioner 
following an internal review of complaints data in October 2019 where 


it was apparent that a number of complaints had been received about 


unsolicited direct marketing calls from YCSL. 


Amongst those complaints the Commissioner noted the following of 


particular concern: 


“am writing on behalf of my father who received the call. He is an 
elderly, vulnerable gentleman who is easily taken advantage of, and 
has been plagued in recent years by cold callers selling him all types of 
insurance.. so that he had more than a dozen insurance policies, with 
multiple cover on the same devices, etc. YesConsumer phoned 
unsolicited & sold my father a product for £149.99. Luckily, the family 


is now wise to this & able to complain & demand refunds[...]” (sic) 


“This company called my 87 year old father attempting him to sell him 


a package which blocks calls, ironic I know. He is registered with TPS.” 


(sic) 


“They wanted me to pay £1.50 per week to stop nuisance calls, I told 


them I was registered on TPS, they said they would ring back.” (sic) 


“They've called 5 to 6 times, twice today. We've said that we weren't 
interested and not to call but they still do. When my wife said we'd 


report them they claimed they couldn't be reported” (sic) 


In light of these complaints, the Commissioner sent an initial 
investigation letter to YCSL on 29 October 2019 setting out the 
Commissioner’s concerns and asking that YCSL provides details about, 


inter alia, the Calling Line Identifiers (“CLI”s) it used, volumes of calls 
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over a prescribed period (29 October 2018 - 29 October 2019), and 
evidence of consent for any direct marketing calls made. Evidence of 


thirteen complaints received about YCSL was also provided, although 


the full details of one of these complaints was not visible?. 


20. A response was received on 20 November 2019 by email, whereby 
YCSL confirmed that eleven of the twelve complaints visible from the 
Commissioner’s correspondence were “previous users of [YCSL’s] 
services”. YCSL advised that it had made 1,394,611 outbound calls 
between 29 October 2018 and 29 October 2019, with 48,978 being 
made to “existing customers”. YCSL confirmed that it would screen all 
data obtained from third-party data providers against the TPS (which, 
the Commissioner was told, accounted for 1,345,633 of the outbound 
calls made by YCSL). 


21. YCSL further confirmed details of the CLIs that it would use during its 
calls and stated that it would use two trading names during its calls: 


‘Yes Consumer Solutions’ and ‘Block Those Calls’. 


22. On 17 August 2020, during a call between YCSL and the Commissioner, 
further information was requested regarding YCSL’s data purchasing, 


and due diligence checks. 


23. YCSL responded on 28 August 2020 confirming that it had acquired the 
customer database of a separate company (‘Yes Media Solutions 
Limited’) in February 2017 as part of an asset purchase. Contact to 
this database would be to “provide ongoing technical support and to 
offer upgrades of services”, and the method of contact would be 
determined by the information held for each individual. It is 


understood that YCSL’s references throughout the investigation to its 


' The Commissioner has since obtained evidence that no fewer than twelve of these thirteen complaints concerned 
calls made to telephone numbers which had been registered with the TPS for at least 28 days at the time which they 
received a call. 
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“existing customers” is in fact a reference to individuals whose data 


had been obtained from Yes Media Solutions Limited. 


YCSL further confirmed that, in relation to data obtained from its third- 
party data providers, it would always request ‘opt-in policies’ and 
assurances that checks had been carried out against the TPS register. 
Furthermore, YCSL would conduct its own TPS checks. YCSL provided 
three sample “supplier source opt-in policies” in Microsoft Word format 
(“.docx”), although the Commissioner notes that it was not made clear 
which of their third-party data provider these scripts were provided on 
behalf of. 


On 3 September 2020 the Commissioner made further contact with 
YCSL and requested information regarding the identity of its third-party 
data providers, and details of the websites used by them, together with 
call dialler records (“CDR"”s) for the period of 29 October 2018 to 29 
October 2019. 


A response was received on 24 September 2020 confirming that YCSL 


had requested “opt-in compliance” from all of the third-party data 
providers used between 29 October 2018 to 29 October 2019. YCSL 
provided details of ten third-party data providers: 


Of these, two were still being used by YCSL with their ‘compliance info’ 


being prvi 


In relation to I, YCSL provided a i 


Seen headed document titled ‘Full Compliance Pack’, which had 
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been updated in September 2019. The Commissioner noted that ‘J 


E was a data broker, and that the three 


“supplier source opt-in policies” which had been provided by YCSL on 


28 August 2020 had all been directly lifted from template scripts within 
this document, which may or may not have been used by yo | 
0 KUBS when collecting data. No information 
was provided about what affiliates/websites would be used to collect 


the data which was subsequently obtained by YCSL. 


In relation to N, a Microsoft Powerpoint document 


was provided purporting to show the customer journey for an individual 
using its vebsite e). Whilst this website’s ‘sign- 
up’ page appears to allow individuals a choice of direct marketing 
methods, it does not appear to allow individuals the ability to select 
which, if any of the ‘partners’ and/or sectors it may wish to receive 
“offers and marketing” about. In any event, further down the page, 
directly above the sign-up button, and apparently regardless of any 
earlier preferences expressed by an individual, the page script states: 
“We will also share your registration information with trusted third- 
party partners for marketing and advertising purposes. For more 
details about them [...] please see our Privacy Policy”. The Privacy 
Policy lists forty-three sectors, and provides a link to its full list of 
‘direct clients’. No evidence has been provided that YCSL are/were 


listed here, although it appears that individuals signing up to 


ee 22 in any event automatically opted-in to 
have their information shared with Ta “trsted 


third-party partners”. 


Of the eight remaining third-party data providers, the Commissioner 
was told that one of the third-party data providers was unable to 


provide the required information as it had been destroyed “due to 


GDPR regulation” C The required 
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information was awaited from four of the third-party data providers 


es vith the remaining 


three either being dissolved ( 


MN), No longer in existence (or “unable to 
contact” (qi). The Commissioner was told 


that via these ten named third-party data providers, a total of 210,472 
records were supplied to YCSL between “October 2018 to October 
2019”. 


YCSL did not provide a list of its CDRs, supplying instead an email 
response from its ‘Dialler Provider’ Ji stating that “this is not an 
option”. It has since been explained by YCSL that the reason it 
provided the email from BM was that it was unable to retrieve the 


requested information itself. 


In an effort to obtain the CDR information for calls made by CLIs 
attributed to YCSL, the Commissioner sent a Third-Party Information 
Notice (“3PIN”) to YCSL’s Communications Service Provider (“CSP”), 


The response indicated that there were thirteen CLIs allocated to YCSL 
over the relevant period, of which seven were used to make calls. The 
Commissioner noted that the seven CLIs stated to be in use correlated 
with CLIs that YCSL had confirmed it had used at the outset of the 


investigation. 


From these seven CLIs it was determined that there was a total of 
442,414 calls made, with 188,493 being registered with the TPS for not 


less than 28 days prior to receiving a call. 


The Commissioner sent a further email to YCSL on 13 October 2020 to 
ask if the remaining third-party data providers had provided the 
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‘compliance info’ that YCSL had been waiting for, and to ask if copies of 


the relevant privacy policies/consent statements could be provided. 


The Commissioner also requested details of the purpose of the calls 
made from each of the seven CLIs which the Commissioner understood 


had been used by YCSL for outbound calls over the relevant period. 


In its response on 20 October 2020 YCSL was unable to confirm what 
the numbers were used for, but speculated as to what they may have 
been used for. YCSL also provided links to four separate privacy 
policies for some of its third-party data providers, but confirmed that 
no further information had been received from them. YCSL 


subsequently provided an email from one of its third-party data 


providers i which confirmed that data had 
been obtained via MM. With this email, YCSL also 


provided a copy of a privacy policy which was allegedly used at the 


time, albeit the privacy policy was in the name (iii 
which is stated to be a trading nam e Þor. 


From the information provided throughout the investigation, where 
possible the Commissioner sought to examine the third-party data 


providers used by YCSL in further detail: 


EE obtained data via 
EE obtained data via i. 
CE obtained data vio aS | 
© Obtained data via i: (aaa 
SE E 


(although the information provided by YCSL suggested that 


PE ay also obtain data from affiliates). 


Regarding i which obtained data via 
en, the Commissioner has been provided only with a 
1] 


41. 


42. 


43. 


44, 


ICO. 


Information Commissioner's Office 


privacy policy fo (ie which it is inferred that 


individuals would have seen when providing their details on 


ee. = YCSL are named in privacy policy, although 
it’s not clear how or why individuals’ using the yyy site 
would have accessed this policy, or what information they were told at 


the point they signed up to i. 


Regarding iE which obtained data via 
ee, it is apparent that individuals were 


automatically opted-in to have their information shared with al 


EE usted third-party partners”. 


Regarding i which obtained data via 
eee, the Commissioner had sight of the privacy 


policy which did not specifically name YCSL but listed over thirty 


sectors. 


Regarding ae Which obtained data via 
een, CSL are named within the site's Privacy Policy 


however to view it an individual would have to search through the 
many listed sectors which il would share 
data with, and then click on the relevant ‘Utilities’ sector. Individuals 
would then see YCSL named together with thirteen other organisations 
in that sector. There appears to be no way however for an individual 
to select which, if any, of the sectors or organisations they may wish to 
be contacted by, or the method by which they may wish to be 


contacted. 


Regarding ii which is understood to 
have obtained data via MR, and from unspecified 


affiliates, the Commissioner has been provided with no information to 
suggest that individuals whose data was obtained by 
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S. its affiliates provided valid consent to be contacted 


by YCSL. 


45. Having reviewed these websites, the Commissioner found that in all but 


ore fC) YCSL were not named as an organisation 


about which subscribers may receive direct marketing?. Where YCSL 


were named (i.e. in x), it is apparent that 


subscribers were required to drill down into the ‘Utilities’ listed partners 
within the privacy policy to see it; and that individuals appeared to be 


automatically opted-in to receive third party direct marketing. 


46. The Commissioner was provided with a link to the privacy policy of I 


PE (Ut noted that YCSL had said no data was 


purchased via this source. 


47. The Commissioner was not provided with website/privacy policy 
information for [is 


48. On 30 October 2020 YCSL sent a further email to the Commissioner 


advising that it was now able to determine what each of the CLIs used 
during the relevant period was used for. Two were used for ‘Outbound 
Call Blocking Campaign’; two were used for ‘Outbound Equity Release 
Campaign’; two were used for ‘Specific Agent Queue’; and one was 
listed as ‘Potential Unused Number - Outbound Equity Release 


Training’. 


49. The Commissioner made further contact with YCSL on 4 December 
2020, referring back to the call volumes that YCSL had provided at the 


? Whilst YCSL were also apparently named in ME privacy policy, it’s not clear what relationship J has 
with EE where the privacy policy was apparently used, or whether it is in fact the privacy policy that 
individuals using that site would have been presented with. 
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outset of the investigation and asking for confirmation of how many of 
the calls made had connected with a subscriber. YCSL’s response of 11 
December 2020 confirmed that between 29 October 2018 and 29 
October 2019 there had in fact been 1,448,671 calls made, of which 


388,796 connected. 


The Commissioner is content however to rely on the information 
provided by YCSL’s CSP (MM that there were a total of 442,414 calls 
made by YCSL over the relevant period using the seven CLIs known to 
have been attributed to it, of which 188,493 calls were connected with 


subscribers who had been TPS registered for not less than 28 days. 


Furthermore, given the nature of the calls made, the Commissioner is 
satisfied that these 188,493 calls were all made for the purposes of 
direct marketing as defined by section 122(5) DPA18. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 

The Commissioner has considered whether those facts constitute a 
contravention of regulation 21 of PECR by YCSL and, if so, whether the 
conditions of section 55A DPA are satisfied. 

The contravention 

The Commissioner finds that YCSL contravened regulation 21 of PECR. 


The Commissioner finds that the contravention was as follows: 


Between 29 October 2018 and 29 October 2019, YCSL used a public 


telecommunications service for the purposes of making 188,493 
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unsolicited calls for direct marketing purposes to subscribers where the 
number allocated to the subscriber in respect of the called line was a 
number listed on the register of numbers kept by the Commissioner in 
accordance with regulation 26, contrary to regulation 21(1)(b) of PECR. 
This resulted in twelve (12) complaints being made to the TPS and the 


Commissioner. 


The Commissioner is also satisfied for the purposes of regulation 21 
that these 188,493 unsolicited direct marketing calls were made to 
subscribers who had not given YCSL specific consent to contact them 
and who had been registered with the TPS for not less than 28 days 


prior to receiving the calls. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 
above was serious. This is because there have been multiple breaches 
of regulation 21 by YCSL arising from the organisation’s activities over 
a twelve-month period, and this led to a substantial number of 
unsolicited direct marketing calls (188,493) being made to subscribers 
who were registered with the TPS, and whom YCSL did not have valid 


consent to contact. 


During the investigation YCSL stated that all new data is purchased via 
third parties, and that it does not currently obtain data directly from 
individuals. The Commissioner understands that the data used by YCSL 


for its unsolicited direct marketing calls would be obtained from a 
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number of third-party data providers which it is appropriate to 


distinguish now: 


Firstly, YCSL obtained a dataset from Yes Media Solutions Limited 
during that company’s liquidation process. Yes Media Solutions 
Limited’s sole director at the time of that company’s liquidation is the 
same individual who is now the sole director of YCSL. Whilst the two 
are distinct legal entities, YCSL have used data obtained from Yes 
Media Solutions Limited to engage in unsolicited direct marketing calls. 
YCSL have failed to evidence how individuals whose data had been 
purchased via an insolvency practitioner for Yes Media Solutions 
Limited in February 2017 have provided valid consent to be contacted 


by YCSL for the purpose of direct marketing. 


Secondly, YCSL states that over the period of 29 October 2018 to 29 
October 2019 it obtained a total of 210,472 individuals’ records via ten 
named third-party data providers. Having attempted to review the 
privacy policies for the websites used by these third-party data 
providers, the Commissioner is concerned that it was not possible for 
an individual to give valid consent via these sites to be contacted by 


YCSL for direct marketing purposes. 


Despite claiming to check data against the TPS register, the 
Commissioner has evidence that 188,493 unsolicited direct marketing 
calls were received by subscribers who had been registered with the 
TPS for not less than 28 days. 


YCSL has accepted in representations that it did not screen the dataset 
which it obtained from Yes Media Solutions Limited, and it has claimed 
that the 188,493 unsolicited direct marketing calls were made to 


individuals whose data was contained within this dataset only. 
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It states that all data obtained via its other ten third-party data 
providers was indeed screened, however the Commissioner has been 
provided with no evidence either during the investigation or during the 
process of representations which proves the veracity of this claim. 
Rather, the Commissioner has been provided with evidence which 


simply purports to demonstrate that some checks were carried out on 
behalf of YCSL, but not the particulars of those checks. 


In the absence of such evidence, the Commissioner is unable to be 
satisfied that the unsolicited direct marketing calls made to individuals 
were made solely to those whose data had been obtained via Yes Media 


Solutions Limited. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A (1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 


above was deliberate. 


The Commissioner considers that in this case YCSL did deliberately 
contravene regulation 21 of PECR. YCSL’s sole director is known to the 
Commissioner, with one of his previous companies having been subject 
to an investigation for suspected unlawful direct marketing prior to 
filing for voluntary insolvency. Despite these prior interactions 
between YCSL’s director and the Commissioner, YCSL appear to have 
been content to be wholly reliant on indirect consent and would appear 
to have conducted minimal due diligence on the data it purchased. 
Indeed, the Commissioner takes the view that the creation of YCSL, the 


use of data obtained from the director’s former company, and the 
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similar trading name used by the two, indicates an apparent 


‘phoenixism’ of the director’s former company, which is in creditors 


voluntary liquidation. 


Further and in the alternative, the Commissioner has gone on to 
consider whether the contravention identified above was negligent. 


This consideration comprises two elements: 


Firstly, she has considered whether YCSL knew or ought reasonably to 
have known that there was a risk that this contravention would occur. 
This is not a high threshold, and she is satisfied that this condition is 


met. 


The Commissioner has published detailed guidance for companies 
carrying out marketing explaining their legal requirements under PECR. 
This guidance explains the circumstances under which organisations 
are able to carry out marketing over the phone, by text, by email, by 
post or by fax. It states that live calls must not be made to subscribers 
who have told an organisation that they do not want to receive calls; or 
to any number registered with the TPS, unless the subscriber has 
specifically consented to receive calls. The Commissioner has also 
published detailed guidance on consent under the GDPR. In case 
organisations remain unclear on their obligations, the ICO operates a 
telephone helpline. ICO communications about previous enforcement 
action where businesses have not complied with PECR are also readily 


available. 


Standard practice of the TPS is to contact the organisation making the 
calls on each occasion a complaint is made. It is therefore reasonable 
to believe that YCSL would have received a notification from the TPS 


for each of the complaints being made in this case, indeed YCSL appear 
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to have acknowledged during the investigation that such notifications 
were received and “addressed internally”. Such notifications should 


reasonably have made YCSL aware of the risk that such contraventions 


may occur and were indeed occurring. 


Further, the director of YCSL is an individual who has been involved in 
previous correspondence with the Commissioner regarding company 
obligations under PECR when engaging in direct marketing. It is not 
feasible to suggest that YCSL were unaware of the inherent risks in 


such activity. 


It is therefore reasonable to suppose that YCSL should have been 


aware of its responsibilities in this area. 


Secondly, the Commissioner has gone on to consider whether YCSL 
failed to take reasonable steps to prevent the contravention. Again, she 


is satisfied that this condition is met. 


The data relied on by YCSL was wholly bought-in from third parties, i.e. 
from Yes Media Solutions Limited, and ten additional third-party data 
providers which it engaged the services of between October 2018 and 
October 2019. This constitutes reliance on indirect consent, since YCSL 
will have had no previous contact with those individuals it intended to 
contact. The Commissioner’s direct marketing guidance makes clear 
that organisations utilising bought-in marketing lists from a third-party 
must undertake rigorous checks to satisfy themselves that the personal 
data was obtained fairly and lawfully, that their details would be passed 
along for direct marketing to the specifically named organisation in the 
case of live calls, and that they have the necessary consent. It is not 
acceptable to rely on assurances given by third party suppliers without 
undertaking proper due diligence. 
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Reasonable steps in these circumstances may also have included 
requesting evidence from its third-party data providers for evidence 
that subscribers had specifically consented to receiving direct 
marketing calls from YCSL; no such evidence has ever been provided. 
YCSL should have also taken steps to screen any purchased data 
against the TPS register to ensure that it was not making unsolicited 
direct marketing calls to those who had specifically registered to avoid 
such calls; the fact that so many calls were made to individuals 
registered with the TPS for not less than 28 days suggests that such 
checks were not carried out, or at the very least that such checks were 
not carried out as rigorously as they should have been. The 
Commissioner also notes evidence from the complaints of repeated 
calls being made to subscribers despite objections, which suggests that 
YCSL’s internal suppression list was inadequate and ineffectively 


applied. 


Given the volume of unsolicited direct marketing calls received, it is 
clear that YCSL failed to take reasonable steps to prevent the 


contravention. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


The Commissioner's decision to issue a monetary penalty 


The Commissioner has taken into account the following aggravating 


features of this case: 


The Commissioner is concerned by the evidence of persistent/repeated 


calls and evidence that YCSL provided misleading information to 
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individuals, specifically that its product (i.e. call blocking services) would 


prevent unsolicited calls; 


Whilst YCSL engaged with the Commissioner’s investigation, she is 
concerned that its responses were obstructive and lacking in sufficient 
content to assist the Commissioner’s investigation. In particular, YCSL 
maintained incomplete records, poor audit trails, and were unable to 
provide satisfactory responses regarding data obtained from third-party 


data providers. 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. She is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out her preliminary thinking. In reaching her final 
view, the Commissioner has taken into account the representations 

made by YCSL on this matter and remains satisfied that a monetary 


penalty notice is an appropriate course of action. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 


The Commissioner has considered whether, in the circumstances, she 


should exercise her discretion so as to issue a monetary penalty. 


The Commissioner has considered the likely impact of a monetary 
penalty on YCSL. She has decided on the information that is available 
to her that a penalty remains the appropriate course of action in the 


circumstances of this case. 
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The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls is a matter of significant public 
concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. This is an opportunity 
to reinforce the need for businesses to ensure that they are only 


telephoning consumers who want to receive these calls. 


For these reasons, the Commissioner has decided to issue a monetary 


penalty in this case. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £170,000 (one hundred and seventy 
thousand pounds) is reasonable and proportionate given the 
particular facts of the case and the underlying objective in imposing the 


penalty. 
Conclusion 


The monetary penalty must be paid to the Commissioner’s office by 
BACS transfer or cheque by 27 August 2021 at the latest. The 
monetary penalty is not kept by the Commissioner but will be paid into 
the Consolidated Fund which is the Government’s general bank account 
at the Bank of England. 
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If the Commissioner receives full payment of the monetary penalty by 

26 August 2021 the Commissioner will reduce the monetary penalty 

by 20% to £136,000 (one hundred and thirty-six thousand 

pounds). However, you should be aware that the early payment 


discount is not available if you decide to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 


(a) the imposition of the monetary penalty 
and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 


penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 
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96. In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 


an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 29" day of July 2021. 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person 
upon whom a monetary penalty notice has been served a right of 
appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 


against the notice. 
2 If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of 
discretion by the Commissioner, that she ought to have exercised 


her discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3: You may bring an appeal by serving a notice of appeal on the 


Tribunal at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LE1 8D] 
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Telephone: 0203 936 8963 
Email: grc@justice.gov.uk 


a) The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 

b) If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 
rule. 


The notice of appeal should state: - 


a) your name and address/name and address of your 


representative (if any); 


b) an address where documents may be sent or delivered to 


you, 

c) the name and address of the Information Commissioner; 
d) details of the decision to which the proceedings relate; 
e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above the 


notice of appeal must include a request for an extension of time 
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and the reason why the notice of appeal was not provided in 


time. 


5: Before deciding whether or not to appeal you may wish to consult 
your solicitor or another adviser. At the hearing of an appeal a party 
may conduct his case himself or may be represented by any person 


whom he may appoint for that purpose. 


6. The statutory provisions concerning appeals to the First-tier 
Tribunal (Information Rights) are contained in section 55B(5) of, and 
Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure 
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009 
(Statutory Instrument 2009 No. 1976 (L.20)). 
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